PDU Session Establishment¶

Learning objectives¶

After reading this page, you will be able to:

• Explain what a PDU Session is (a logical user-plane pipe that goes through the UPF and out to the DN (Data Network)).
• Explain the Why (even after registration and authentication are done, why can't data flow until a PDU Session is set up?).
• Explain, in order, the major steps of UE-requested PDU Session Establishment (request → SMF selection → subscriber data/policy → UPF configuration over N4 → Accept + N2 resource setup → user-plane connectivity).
• Explain the roles of SMF / UPF / N4(PFCP) / N3(GTP-U) respectively.
• Explain CUPS (the separation of the control-plane SMF and the forwarding-plane UPF) with a diagram.
• Understand the basics of QoS Flow (QFI, 5QI, QoS Flow ↔ DRB mapping).
• Explain the roles of DNN / S-NSSAI / PDU Session Type / SSC mode.
• List the focal points for analyzing SM NAS / N4(PFCP) / N3(GTP-U) / NGAP packets in Wireshark.

Prerequisites¶

It will go more smoothly if you first understand the following. If you haven't yet, start from the curriculum.

• Completion of Registration (the UE is registered, i.e., 5GMM-REGISTERED) → Initial Registration
• Completion of Authentication (primary authentication and NAS security established) → Authentication
• NAS / N1 (the layer that carries control messages between UE and AMF; SM NAS also passes through here) → N1
• The role of the AMF and the idea of SBA / NF → AMF / NF Dictionary

What you'll learn in this chapter¶

This chapter focuses narrowly on UE-requested PDU Session Establishment (TS 23.502 §4.3.2.2). It is the procedure by which a UE that has finished registration and authentication sets up the "pipe (PDU Session)" needed to actually carry data.

• Network-requested PDU Session Modification / Release is out of scope for this chapter (see Next Step).
• Secondary Authentication (per-PDU-session authentication with an external DN-AAA, TS 33.501 §11) is covered only at an overview level; the details are out of scope.
• Handover and user-plane re-establishment via Service Request (CM-IDLE→CM-CONNECTED) are also out of scope.

Why — why a PDU Session is needed¶

Let's start with the Why (why it's needed). Even after a UE has completed Registration and Authentication, that alone means not a single byte of user data flows. What registration and authentication established is "a check-in to the network, identity verification, and keys for control" — not the path (the pipe) that carries data itself.

To do data communication, you need to set up one logical pipe that goes from the UE, through the UPF (User Plane Function), and out to the DN (Data Network, e.g., the internet or a corporate network). This is the PDU Session.

Overview¶

In PDU Session Establishment, roughly the following flow takes place.

A registered UE requests session establishment from the SMF (Session Management Function) via the AMF → the SMF fetches subscriber data from the UDM and (optionally) policy (QoS) from the PCF → it configures packet forwarding rules on the UPF over N4 (PFCP) → it returns a PDU Session Establishment Accept to the UE via the AMF, and at the same time sets up user-plane resources on the gNB over N2. Finally, the gNB's tunnel information (TEID) is applied to the UPF, and the N3 (GTP-U) user plane becomes connective.

flowchart LR
    UE([UE]) -->|"1.Establishment Request (N1/SM NAS)"| AMF[AMF]
    AMF -->|"2.Nsmf_PDUSession (N11-equivalent)"| SMF[SMF]
    SMF -->|"3.subscriber/policy"| POL{UDM / PCF}
    SMF -->|"4.N4 (PFCP)"| UPF[UPF]
    SMF -->|"5.Accept + N2 info"| AMF
    AMF -->|"6.N2 Resource Setup"| gNB["(R)AN / gNB"]
    gNB -.->|"7.N3 (GTP-U) connectivity"| UPF
    UPF -->|"N6"| DN[(Data Network)]

What matters here is CUPS (Control and User Plane Separation). The SMF is the "brain (control)" and the UPF is the "pipe (forwarding)", separated from each other, and the SMF instructs the UPF over N4 (PFCP) on "how to forward."

Basic Concept — a beginner-friendly explanation¶

To understand PDU Sessions, there are a few keywords to nail down.

1. PDU Session and PDU Session ID¶

• PDU Session — the logical connection (pipe) that carries user data between the UE and the DN. A single UE can hold multiple PDU Sessions at the same time (e.g., one for the internet and one for a corporate network).
• PDU Session ID — the number that distinguishes those multiple sessions. It is assigned by the UE and included in the establishment request.

2. DNN (which network to connect to)¶

• DNN (Data Network Name) — the name of the destination data network. It corresponds to the 4G APN (Access Point Name). Things like "internet," "IMS (voice)," and "corporate network" are specified by the DNN.

3. S-NSSAI (which slice to use)¶

• S-NSSAI (Single Network Slice Selection Assistance Information) — an identifier indicating the network slice to use. A slice is a logical partition of the same physical network by purpose (e.g., mobile broadband / IoT / ultra-low-latency). For a PDU Session, the combination of (DNN, S-NSSAI) determines which network and which slice to use.

4. PDU Session Type (what kind of pipe it carries)¶

(Basis: around TS 23.501 §5.6.1. The completeness of the enumerated values is to be confirmed.)

5. SSC mode (session continuity)¶

• SSC mode (Session and Service Continuity mode) — the policy for whether to keep or change the IP address (anchor UPF) upon movement. There are SSC mode 1 (keep the anchor), modes 2/3 (involving re-establishment), and so on (around TS 23.501 §5.6.9; details to be confirmed).

6. QoS Flow (the unit of quality)¶

• QoS Flow — a grouping of traffic to which the same quality (QoS) is applied within a PDU Session. In 5G, this QoS Flow is the finest granularity of QoS.
• QFI (QoS Flow Identifier) — the number that identifies a QoS Flow.
• 5QI (5G QoS Identifier) — a standardized number representing quality characteristics such as latency, packet loss rate, and priority (corresponding to the 4G QCI).
• QoS Flow ↔ DRB mapping — over the radio segment, a QoS Flow is mapped to a DRB (Data Radio Bearer) (handled by the gNB). Multiple QoS Flows can also be carried on a single DRB.

Architecture¶

Here are the elements involved in PDU Session Establishment and the interfaces that connect them. The star of this chapter is the point that the control plane (SMF) and the user plane (UPF) are separated (CUPS).

flowchart LR
    subgraph CP["Control Plane"]
      AMF[AMF]
      SMF[SMF]
      PCF[PCF]
      UDM[UDM]
    end
    subgraph UP["User Plane"]
      UPF[UPF]
    end

    UE([UE]) -- "N1 (SM NAS)" --> AMF
    UE -. "Uu (RRC)" .- RAN["(R)AN / gNB"]
    RAN -- "N2 (NGAP)" --> AMF
    AMF -- "N11-equivalent (Namf/Nsmf, SBI)" --> SMF
    SMF -- "N7 (Npcf)" --> PCF
    SMF -- "N10 (Nudm)" --> UDM
    SMF -- "N4 (PFCP)" --> UPF
    RAN == "N3 (GTP-U)" ==> UPF
    UPF == "N6" ==> DN[(Data Network)]

The roles of each element are as follows.

• UE — the terminal that requests the PDU Session. It generates the SM NAS (PDU Session Establishment Request) and uses the assigned UE IP.
• (R)AN / gNB — radio access. It relays the SM NAS and, over N2, sets up the user-plane resources (DRB, N3 tunnel). It handles the QoS Flow ↔ DRB mapping.
• AMF — the NAS point of contact. It does not interpret the contents of the SM NAS; it relays them to the SMF (terminating N1/N2 and bridging Namf/Nsmf).
• SMF (Session Management Function) — the command center for session management. It handles UE IP assignment, UPF selection, UPF control over N4, and QoS decisions.
• UPF (User Plane Function) — the forwarding substance of the user plane. It terminates N3 (gNB side) and N6 (DN side), and forwards packets, applies QoS, and measures charging exactly as instructed by the SMF (N4).
• PCF (Policy Control Function, conditional) — provides QoS/charging policy (PCC rules) (N7).
• UDM — the source of session-management subscription data (allowed DNN/S-NSSAI, etc.) (N10).

For details on the interfaces, see the Interface Dictionary.

Network Function¶

Interface / Protocol¶

Here are the interfaces and protocols used in this procedure.

For details on the protocols, see the Protocol Dictionary, and for the interface list, see the Interface Dictionary. For related individual pages, see SMF / UPF, N3 / N4.

Procedure — Call Flow¶

This is the heart of this page. The main steps, compliant with 3GPP TS 23.502 §4.3.2.2.1 (UE-requested PDU Session Establishment), are shown as a Mermaid sequenceDiagram.

sequenceDiagram
    autonumber
    participant UE
    participant RAN as (R)AN / gNB
    participant AMF
    participant SMF
    participant UDM
    participant PCF
    participant UPF

    UE->>AMF: PDU Session Establishment Request
(SM NAS: PDU Session ID, DNN, S-NSSAI, PDU Session Type)
    Note right of UE: SM message nested in NAS
TS 24.501 §6.4.1
    Note right of AMF: The AMF doesn't interpret the SM NAS; it does SMF selection
    AMF->>SMF: Nsmf_PDUSession_CreateSMContext
(SUPI, PDU Session ID, DNN, S-NSSAI, SM NAS)
    Note right of AMF: TS 23.502 §4.3.2.2.1
    SMF->>UDM: Nudm_SDM_Get (fetch Session Management subscription data)
    UDM-->>SMF: allowed DNN/S-NSSAI, default QoS, etc.
    SMF-->>AMF: Nsmf_PDUSession_CreateSMContext Response

    opt SM Policy Association (PCF interaction, optional/conditional)
        SMF->>PCF: Npcf_SMPolicyControl_Create
        PCF-->>SMF: PCC rules / authorized QoS
    end

    Note over SMF: UE IP address assignment / UPF selection
    SMF->>UPF: N4 Session Establishment Request (PFCP)
(PDR/FAR/QER, instruction to assign UPF-side N3 TEID)
    UPF-->>SMF: N4 Session Establishment Response
(UPF-side N3 TEID / UPF IP)
    Note right of UPF: TS 29.244 (PFCP)

    SMF->>AMF: Namf_Communication_N1N2MessageTransfer
(N1: PDU Session Establishment Accept + N2 SM info)
    Note right of SMF: N2 SM info carries QoS Flow (QFI/5QI) and UPF-side N3 info
    AMF->>RAN: N2 PDU Session Resource Setup Request (NGAP)
(N1 Accept bundled in)
    RAN->>UE: RRC Reconfiguration (AN-specific resources: DRB setup)
    UE-->>RAN: RRC Reconfiguration Complete
    Note over RAN,UE: Deliver N1 Accept to the UE / QoS Flow↔DRB mapping
    RAN->>AMF: N2 PDU Session Resource Setup Response
(gNB-side N3 TEID / gNB IP)
    AMF->>SMF: Nsmf_PDUSession_UpdateSMContext (gNB-side N3 info)
    SMF->>UPF: N4 Session Modification Request (PFCP)
(apply gNB-side N3 TEID to the FAR)
    UPF-->>SMF: N4 Session Modification Response
    Note over UE,UPF: N3 (GTP-U) user plane connective → data communication possible

Step-by-step explanation (numbers correspond to the diagram above)¶

1. UE→AMF: PDU Session Establishment Request (SM NAS). It includes the PDU Session ID, DNN, S-NSSAI, and PDU Session Type. The SM NAS is a 5GSM (Session Management) message, carried nested inside an MM NAS (5GMM) message.
2. AMF→SMF: The AMF does not interpret the contents of the SM NAS; via SMF selection it picks an appropriate SMF and hands over the SM NAS as-is with Nsmf_PDUSession_CreateSMContext. 3-4. SMF→UDM: It fetches session-management subscription data (allowed DNN/S-NSSAI, default QoS, etc.) with Nudm_SDM_Get.
3. SMF→AMF: The CreateSMContext response (confirming context creation).
4. (optional/conditional) SMF↔PCF: It establishes an SM Policy Association with Npcf_SMPolicyControl_Create and fetches PCC rules / authorized QoS (in a dynamic-PCC configuration; if absent, it continues with the SMF's default QoS = configuration-dependent).
5. (inside the SMF) UE IP address assignment and UPF selection (which UPF to use).
6. SMF→UPF: With N4 Session Establishment (PFCP), it sets forwarding rules on the UPF (PDR = Packet Detection Rule / FAR = Forwarding Action Rule / QER = QoS Enforcement Rule, etc.). At this point the UPF-side N3 TEID is assigned.
7. SMF→AMF→gNB: With Namf_Communication_N1N2MessageTransfer (provided by the AMF, consumed by the SMF), the SMF hands the AMF both the N1 (PDU Session Establishment Accept) and the N2 SM info (QoS Flow = QFI/5QI, UPF-side N3 info) together. The AMF forwards this to the gNB as an N2 PDU Session Resource Setup Request (NGAP).
8. gNB↔UE: The gNB sets up AN-specific resources (DRB) with RRC Reconfiguration, performs the QoS Flow↔DRB mapping, and delivers the bundled N1 Accept to the UE.
9. gNB→AMF→SMF: With the N2 Resource Setup Response, it returns the gNB-side N3 TEID to the SMF (via Nsmf_PDUSession_UpdateSMContext).
10. SMF→UPF: With N4 Session Modification (PFCP), it applies the gNB-side N3 TEID to the FAR (finalizing the downlink destination).
11. User-plane connectivity: Now the uplink and downlink N3 (GTP-U) tunnels are both in place, and data communication over UE↔gNB↔UPF↔DN becomes possible.

References: TS 23.502 §4.3.2.2.1 (UE-requested PDU Session Establishment), TS 24.501 §6.4.1 (NAS-side PDU session establishment).

Signal Flow¶

The main messages / service operations are organized in a table.

For the detailed IEs and reference specs of each message, see the Message Dictionary.

State Machine¶

Here is the (conceptual) user-plane state transition of a PDU Session. The UE's 5GSM side also has states such as "PDU SESSION ACTIVE" (basis: TS 23.501 §5.6 / TS 24.501 §6.1.3. Some state names differ in implementation representation and are to be confirmed).

stateDiagram-v2
    [*] --> INACTIVE
    INACTIVE --> ACTIVATING: Establishment Request → configuring SMF/UPF
    ACTIVATING --> ACTIVE: N3 tunnel established (U-Plane connective)
    ACTIVATING --> INACTIVE: establishment failure / Establishment Reject
    ACTIVE --> INACTIVE: PDU Session Release
    ACTIVE --> ACTIVE: Modification (QoS change, etc.; state preserved)
    ACTIVE --> [*]

• INACTIVE — the PDU Session is not established, or the U-Plane is inactive.
• ACTIVATING — a transient state during establishment processing (configuring SMF/UPF/N4/N2). On establishment failure or a Reject, it returns to INACTIVE.
• ACTIVE — the U-Plane is connective. Data communication is possible. A QoS change (Modification) is done while remaining in ACTIVE.

Packet Analysis (Wireshark)¶

Because PDU Session Establishment spans multiple segments, you use different filters per segment.

Main display filters¶

Points to look at when decoding (main IEs)¶

• PDU Session ID / DNN / S-NSSAI (in the SM NAS Request) — which session, which network, which slice.
• PDU Session Type / UE IP address (in the SM NAS Accept) — the assigned IP and type.
• QoS Flow (QFI / 5QI) (in the Accept / N2 SM info) — the quality allocation.
• TEID (in N3 GTP-U / PFCP) — the tunnel identifier. Two of them, the UPF side and the gNB side, are exchanged.

The SM NAS is nested in the MM NAS¶

The SM NAS (5GSM) does not travel on its own; it passes over N1 nested inside the MM NAS (5GMM). Further, over the N2 segment it is nested in NGAP, so the hierarchy is as follows.

NGAP-PDU
 └─ (Uplink/Downlink)NASTransport, etc.
     └─ NAS-PDU
         └─ 5GS NAS (5GMM: e.g., UL NAS TRANSPORT)
             └─ 5GS NAS (5GSM: PDU Session Establishment Request)

Configuration¶

Here are the structure-level essentials of the configuration needed to make PDU Session Establishment succeed. Concrete values and vendor-specific items (Cisco, etc.) are implementation-dependent, and we do not write fictitious values here.

SMF side (e.g., the SMF configuration of Open5GS / free5GC)¶

• The DNN (destination data network name, equivalent to the 4G APN) and the associated UE IP pool (the range of IP addresses to assign).
• The correspondence between the S-NSSAI (supported slices) and the DNN.
• UPF specification (which UPF to use, the basis of UPF selection) and the N4 (PFCP) connection destination.
• Default QoS (default values of 5QI/QFI, ARP, etc.) — the quality in a PCF-less (static PCC) configuration.

UPF side¶

• Configuration of the N3 / N6 interfaces (gNB side / DN side).
• Preparation to apply the rules received from the SMF over N4 (PFCP) (the PFCP association).
• Routing beyond N6 (the route to the DN/internet; NAT, etc., is configuration-dependent).

Subscriber data (UDM/UDR)¶

• Registration of the allowed DNN / allowed S-NSSAI for the subscriber (SUPI/IMSI).
• Session-management subscription data such as default QoS and (if needed) a static UE IP.

Trouble Shooting¶

Here is the triage for representative PDU Session establishment failures. For details on Cause values, see the Cause Dictionary.

Comparison with EPC¶

Let's contrast them so that those experienced with 4G (EPC) can bridge over to 5G.

Release differences¶

We mark uncertain items as to be confirmed and do not assert them.

• Rel-15 — The PDU Session / QoS Flow model, SMF/UPF separation (CUPS), N4 (PFCP), DNN/S-NSSAI, and the basics of UE-requested PDU Session Establishment were established (the foundation of TS 23.501/23.502/24.501).
• Rel-16 — The generation in which extensions such as slicing, URLLC, TSC (Time-Sensitive Communication), and Ethernet PDU advanced (the extent to which these are woven into the PDU Session establishment procedure itself is to be confirmed).
• Rel-17 / Rel-18 (5G-Advanced) — Feature extensions continue (the concrete differences to the establishment procedure are to be confirmed).

3GPP Specification¶

FAQ¶

Summary¶

• A PDU Session is a logical pipe that carries user data from the UE, through the UPF, and out to the DN. Registration and authentication alone are not enough to communicate; only once this is set up does data flow.
• The major flow is establishment request → SMF selection → fetch subscriber data/policy → configure the UPF over N4 → Accept + N2 resource setup → establish the N3 tunnel.
• The SMF is control (brain) and the UPF is forwarding (pipe), separated (CUPS), and N4 (PFCP) connects the two. User data is carried over N3 (GTP-U).
• DNN (which network), S-NSSAI (which slice), PDU Session Type, and QoS Flow (QFI/5QI) are the main parameters.
• The user plane becomes connective through the two N4 stages of Establishment→Modification, aligning the TEID on the UPF side and the gNB side.
• Secondary Authentication is covered only at an overview level (per-PDU-session authentication with an external DN-AAA; optional).
• The basis is TS 23.502 §4.3.2.2 / TS 24.501 §6.4 / TS 23.501 §5.6・§5.7 / TS 29.244.

Practice — comprehension check and exercises¶

Comprehension check¶

Exercises¶

Question: Reorder the following main steps of UE-requested PDU Session Establishment into the correct order.

A. SMF → UPF: N4 Session Establishment (PFCP, set PDR/FAR/QER)
B. UE → AMF: PDU Session Establishment Request (SM NAS)
C. AMF → gNB: N2 PDU Session Resource Setup (N1 Accept bundled in)
D. AMF → SMF: Nsmf_PDUSession_CreateSMContext
E. SMF → UPF: N4 Session Modification (apply gNB-side N3 TEID)
F. SMF → UDM: Nudm_SDM_Get (fetch subscription data)
G. gNB → AMF → SMF: N2 response (gNB-side N3 TEID)

Next Step¶

Here are the next steps to deepen your understanding.

• QoS chapter (details of QoS Flow, QFI, 5QI, GBR/Non-GBR, AMBR, DRB mapping) / Network Slicing chapter (slice selection, S-NSSAI)
• Security chapter (details including Secondary Authentication)
• PDU Session Modification / Release chapter (session modification/release, out of scope for this chapter)
• Preconditions of the procedure: Initial Registration / Authentication
• Related NFs: AMF ／ SMF ／ UPF ／ PCF
• Related interfaces: N1 / N2 / N3 / N4 / N6 / N7
• Dictionaries: Message Dictionary / Timer Dictionary / Cause Dictionary / Protocol Dictionary / NF Dictionary / Interface Dictionary